veilor-org/veilor-os
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions
veilor-os/bluebuild
History
s8n-ru 702702650a
Some checks failed
Build veilor-os Installer ISO / Build installer ISO (push) Failing after 28s
Details
Build veilor-os OCI (BlueBuild) / Build + push OCI (push) Failing after 3h10m14s
Details
fix(bluebuild): move brand-leak check recipe RUN -> CI smoke-test 
- STEP 14/30 hung under buildah fuse-overlayfs scanning
  /usr/share/veilor-os on ~130-layer secureblue base (Forgejo run 171,
  2026-05-07, hit 360-min timeout, no error logged).
- Brand-leak grep -rqi removed from bluebuild/recipe.yml RUN snippet;
  one-line comment left in its place pointing at the new location.
- Added equivalent assertion at the end of the Smoke-test OCI image
  step in .github/workflows/build-bluebuild.yml. Runs once on the
  sealed image (no overlayfs in flight), uses `find -type f` over
  bounded paths + name globs (text files only), then a single grep
  invocation — much faster than recursive grep over the whole tree.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-08 00:52:09 +01:00
..
config/just v0.7 spike: BlueBuild recipe + ostreecontainer kickstart + cosign workflow 2026-05-05 15:30:04 +01:00
cosign.pub ci(bluebuild): add cosign keypair signing infra 2026-05-06 17:48:58 +01:00
README.md bluebuild: switch base to ghcr.io/secureblue/kinoite-main-hardened 2026-05-06 17:15:54 +01:00
recipe.yml fix(bluebuild): move brand-leak check recipe RUN -> CI smoke-test 2026-05-08 00:52:09 +01:00

README.md

bluebuild/ — v0.7 spike

This directory contains the BlueBuild recipe + supporting config that builds the veilor-os bootable OCI image. Active on the v0.7-bluebuild-spike branch only. Does NOT land in v0.5.x main until the spike passes its success criteria (see docs/STRATEGY.md).

What's here

bluebuild/
├── recipe.yml                  # primary BlueBuild recipe
├── config/
│   └── just/
│       └── 60-veilor.just      # ujust recipes for opt-in components
└── README.md                   # this file

The recipe extends ghcr.io/secureblue/kinoite-main-hardened:latest. We inherit secureblue's hardening (sysctl + kargs + custom SELinux policy + USBGuard + hardened-malloc + Unbound DoT + chronyd NTS + Trivalent browser + cosign-signed image chain). On top, we layer:

  • veilor branding (overlay/, theme, plymouth, sddm, os-release)
  • mullvad-browser (anti-fingerprint companion to Trivalent)
  • xorg-x11-server-Xwayland (re-enable; secureblue disables it)
  • sudo (re-enable; secureblue replaces with run0)
  • tailscale + yggdrasil (mesh stack layer 1 + 2)
  • ujust recipes for Reticulum (mesh layer 3) + Thorium (opt-in browser)

Trivalent stays as the default browser (correcting an earlier draft).

Build locally

# Requires bluebuild CLI:
#   curl -fsSL https://raw.githubusercontent.com/blue-build/cli/main/install.sh | sh
cd bluebuild
bluebuild build recipe.yml

Output: localhost/veilor-os:43 in podman storage. Push to GHCR via the workflow.

Test the OCI image

# Smoke-test (boots into the rootfs; no kernel, no init):
podman run --rm -it ghcr.io/veilor-org/veilor-os:43 /bin/bash

# Inside, sanity:
cat /etc/os-release        # PRETTY_NAME=veilor-os
which sudo                 # /usr/bin/sudo (re-enabled)
which trivalent            # secureblue's COPR (default browser)
which mullvad-browser      # /usr/bin/mullvad-browser
systemctl is-enabled yggdrasil    # enabled (idle)
systemctl is-enabled tailscaled   # disabled (awaits ujust veilor-mesh-join)

Test the installer ISO

The installer ISO is built separately by livecd-creator (current path) or bootc-image-builder (v1.0+). Its kickstart's %packages block is replaced with:

ostreecontainer --url=ghcr.io/veilor-org/veilor-os:43 --transport=registry

That populates the target's / directly from this OCI image during the install pass. No first-boot rebase. No transition window.

Spike success criteria (1 day)

  • bluebuild build recipe.yml exits 0
  • bootc container lint exits 0 on the resulting image
  • podman run smoke-test (commands above) all pass
  • .github/workflows/build-bluebuild.yml builds + cosign-signs + pushes to ghcr.io/veilor-org/veilor-os:43
  • An installer ISO using ostreecontainer against this OCI reaches SDDM with admin login on first boot

If all five land, merge v0.7-bluebuild-spike → main as v0.7.0. If any fail in ways that aren't trivially fixable, file each as a GH issue + return to v0.5.x kickstart path.

See also